Read the audit log

tovio audit logtovio audit summarytovio audit summary --last 7d

Every actor keeps a signed audit chain. log lists entries newest-first; summary aggregates them over a window, which is usually what you want when answering "what happened last week".

What is recorded

Access decisions, key operations, grants and revocations, agent commits with their token, policy changes, device enrolment and revocation, obliterations, and administrative actions. Entries are signed and hash-chained per actor, so removing or reordering one is detectable.

What a summary looks like

audit summary is the readable rollup rather than the raw walk: protected-read counts by effective principal, the distinct paths touched, a breakdown by event type (including denials), and the policy changes in the window. --last takes a duration such as 30m, 24h, or 7d; omit it and you get all of history.

Output formats

tovio audit log --format jsontovio audit log --format csvtovio audit log --format template:<spec>

human is the default, and the global --json is sugar for --format json. An unrecognised value is rejected as a usage error — though note the chain is walked first, so a typo on a long history is not free.

Narrowing to one object or one token

tovio audit show --object <hash>tovio audit show --token <id>

Exactly one of the two is required. The object hash may carry the blake3: prefix or not, and a prefix of the hash matches. --token is the one to reach for after an incident involving an agent: it gives every recorded action under that token.

This is also the standard recovery path when a read returns an obliterated object or a revoked token — the records say when and by whom.

The filters that are specified but not built

The specification describes audit log --since, --path, --identity, and --agent, along with a per-principal zero-read denial rollup. Those are not implemented yet. Use summary --last for a window and show --object/--token for a subject; anything else, export and query downstream.

Someone else's chain

tovio audit fetch did:key:<hex> --remote <host:port>tovio audit fetch did:key:<hex> --remote <host:port> --cert <forge.der>

The actor is given as a DID, and its public signing key is recovered from that DID and used to verify every entry returned. The Forge serves the raw signed entries; your machine re-verifies them — the Forge does not vouch for them. A tampered or inconsistent chain fails loudly with a non-zero exit; a verification failure is never reported as verified.

Certificate pinning is always enforced and there is no skip path. --cert points at the Forge's DER certificate; omitted, it defaults to this repository's .tovio/relay-cert.der. You can always fetch your own chain; an admin can fetch any actor's.

Secrets are not in it

Audit entries record that access happened, not the content accessed. Secret values are masked and never enter an entry. That is what makes an audit export safe to hand to a system that is not cleared for the repository's protected paths.